Legal

Privacy Policy

Last updated August 20, 2026

The Capture Rig ("we", "us", or "our") provides studio operations software for photographers. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using The Capture Rig you agree to the practices described here.

Information we collect

  • Account information. When you create an account we collect your name, email address, and billing details needed to process your subscription.
  • Studio content. Information you add to run your studio, such as brand settings, project details, intake form responses, and uploaded photos.
  • Client information. Details your clients provide through intake forms or pre-registration, such as their name and contact details. You are responsible for obtaining appropriate consent from your clients.
  • Crew member information. If you use Crew Access, the name, email address, and assigned role (assistant or guest) of the crew members you invite to your studio. You control who you invite and can revoke their access at any time.
  • Usage data. Basic technical information such as device type, browser, and how features are used, to keep the service reliable and secure.

How we use information

  • To provide, maintain, and improve the service.
  • To process payments and manage your subscription.
  • To send transactional messages such as receipts, gallery notifications, and account updates.
  • To respond to support requests.
  • To protect against fraud, abuse, and security threats.

How we share information & sub-processors

We do not sell your personal information. We share information only with the service providers ("sub-processors") that help us operate The Capture Rig, and only as needed to provide the service:

  • Database, authentication & storage - hosting of your account, app data, and uploaded photos.
  • Email delivery - transactional messages such as receipts and gallery notifications.
  • Notification & delivery providers - email, SMS, push, webhook, and automation providers used to send you convenience alerts about leads, downloads, inquiries, and gallery activity.
  • Payment processing - handling subscription and client download payments.
  • Content delivery & storage (CDN) - serving images and assets quickly and securely.
  • AI and face-matching providers - processing images and gallery-scoped face-match data only as needed to provide optional AI features such as AI Photo Finder. AI Photo Finder currently uses Amazon Rekognition in United States regions.

We may also disclose information if required by law.

Email, SMS, push, webhook, and other notifications are convenience alerts only and are not guaranteed to be delivered, received, or read. Your Capture Rig dashboard is the official record of your leads, downloads, inquiries, and gallery activity, and you are responsible for checking it regularly.

AI Photo Finder & biometric data

Some galleries may offer AI Photo Finder, an optional feature that uses face matching to help visitors locate photographs that may include the person shown in a submitted search photo. A photographer can indicate at project creation that they intend to use AI Photo Finder; that preference alone does not start any face indexing. Indexing begins only after the feature is actually enabled for a gallery, the photography location is confirmed where required, and the photographer accepts a versioned acknowledgment.

AI Photo Finder is available only where permitted by our current biometric policy, and the location where the photography occurred may be used to determine whether the feature can be enabled. Before a visitor performs a search, the person initiating the search must affirmatively consent to the use of face matching and confirm they are 18 or older. An adult may initiate a search involving a child or dependent when that adult is the parent, legal guardian, or otherwise authorized to provide permission for the search; the child is not asked to accept the notice separately. Visitors who do not want to use AI Photo Finder can browse the gallery normally. Each search is authorized by a short-lived, signed token bound to that gallery, and we record the version of the consent notice that was accepted and when.

Search photos

The photo submitted for a search is used to perform the requested search. The Capture Rig application does not intentionally persist the search photo as part of a gallery, photo library, account asset, or reusable face profile.

Gallery-scoped matching

Face-match data is scoped to the individual gallery for which AI Photo Finder is enabled. A search performed in one gallery is not used to search other galleries, studios, brands, or a broader Capture Rig face database. Gallery face collections are isolated, and there is no global Capture Rig face database.

Purpose limitation

We do not use AI Photo Finder face-match data for:

  • advertising or marketing;
  • behavioral profiling;
  • surveillance;
  • legal identity verification;
  • demographic inference;
  • training AI models; or
  • building a persistent global face database.

We do not sell biometric data.

Biometric retention

AI Photo Finder face-match collections are not intended to be retained indefinitely. We currently apply a 365-day inactivity retention period, measured from the last AI Photo Finder use in that gallery. Face-match data may be deleted sooner when AI Photo Finder is disabled for the gallery, the gallery is deleted, or another applicable privacy or product lifecycle rule requires deletion.

Verified deletion

When deletion of an AI Photo Finder face-match collection is required, we initiate deletion with the face-matching provider and track the request through completion. If deletion cannot be completed immediately, the system may retry the request and surface unresolved cleanup failures for review.

Non-biometric operational records

Limited non-biometric records, such as consent timestamps, policy versions, audit events, billing records, or security records, may be retained separately from face-match data where necessary for service operation, legal obligations, dispute resolution, security, or audit purposes. These records do not contain biometric templates.

Jurisdiction-aware controls & processing location

We apply jurisdiction-aware controls to AI Photo Finder. The feature may be unavailable in certain locations where our standard biometric workflow is not currently supported, and it is currently restricted for galleries photographed in Illinois, Texas, or Washington. Face matching currently runs on approved United States infrastructure, and biometric processing fails closed if the provider region falls outside that approved configuration. For full details, see our AI Photo Finder & Biometric Privacy Notice and the AI Photo Finder safeguards page.

Cookies

We use strictly necessary cookies to keep you signed in and to keep the service secure. We do not use third-party advertising cookies. You can control cookies through your browser settings, though disabling necessary cookies may affect core functionality.

Your rights (GDPR & UK GDPR)

If you are in the EU or UK, you have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. Our lawful bases for processing are: performance of a contract (to provide the service), legitimate interests (to secure and improve the service), and consent where required. To exercise any right, email us. As a photographer using The Capture Rig, you act as the data controller for your clients' and crew members' information, and we act as your processor. You may also have the right to lodge a complaint with your local supervisory authority.

International data transfers

The Capture Rig and our sub-processors may store and process information in countries other than the one where you or your clients are located, including the United States. Where we transfer personal data across borders, we rely on appropriate safeguards recognized under applicable law, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent mechanisms, to ensure your information remains protected.

Latin America privacy rights

If you are located in Latin America, you have rights over your personal data under your country's data protection laws, and you can exercise them by emailing us.

  • Brazil (LGPD). You have the right to confirmation that we process your data, and to access, correct, anonymize, port, or delete it, as well as to obtain information about how it is shared and to withdraw consent. We process personal data on the bases of consent, performance of a contract, and our legitimate interests, as permitted by Lei Geral de Proteção de Dados (Law No. 13.709/2018).
  • Mexico (LFPDPPP). You may exercise your ARCO rights - Access, Rectification, Cancellation (deletion), and Objection - and limit the use or disclosure of your personal data, under the Federal Law on Protection of Personal Data Held by Private Parties.
  • Other countries. If you reside elsewhere in Latin America (for example Argentina, Chile, Colombia, or Peru), we extend comparable rights of access, correction, and deletion to you under your applicable local data protection laws.

California privacy rights (CCPA/CPRA)

California residents have the right to know what personal information we collect, to request deletion, and to opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information. You will not be discriminated against for exercising these rights.

Data retention

While your account is active, your data remains available to you, and if you pause or cancel your subscription you keep access to it. After you request permanent account deletion, we remove your account and associated data from active systems. We retain certain records for the periods required by the record-keeping, legal, tax, and accounting obligations that apply in the relevant jurisdiction, and as needed to resolve disputes or enforce our agreements; these retention periods vary by jurisdiction.

Breach notification

In the event of a confirmed personal data breach affecting your information, we will notify affected users and, where applicable, regulators without undue delay and within 72 hours of becoming aware of it.

Security

We use industry-standard safeguards to protect your information, including encryption in transit, row-level access controls, optional two-factor authentication, and short-lived signed URLs for private photos. No method of transmission or storage is completely secure, but we work to protect your data and continuously improve our protections.

Your choices

You can access and update most of your information from within the app. You may also request a copy of your data or its deletion by emailing us.

Contact

Questions about this policy? Email us at support@thecapturerig.com.